After the hack of ANTS, France’s secure documents agency, the government handed the securing of State services to DINUM, the interministerial digital directorate, and DITP, the interministerial directorate for public transformation. A choice that raises questions.
Let’s go back over the facts.
In April 2026, ANTS was hacked, by a 15-year-old, for between 12 and 18 million records.
At the same time, the government’s digital suite saw 18 million further records compromised.
The political response? A reorganisation handed to DINUM and DITP. And not to ANSSI, the national cybersecurity agency, whose mandate this precisely is.
It is a choice that reveals something deeper: a persistent confusion about what “securing” really means.
What caused the political outcry was not the seriousness of the stolen data, but the hacker’s age: 15.
Had the hacker been 40, would the flaws have been any less gaping and the data any less exposed?
The cybersecurity debate almost always focuses on the same point: protecting data where it is stored (firewalls, encryption, access controls).
Rarely on what happens before.
Yet that is where security begins.
On the routes this data takes to reach its destination. On the paths it crosses, the nodes it transits through, the infrastructure that carries it.
France-IX has no ambition to secure data. That is not our job.
Our job is to build the routes that data takes.
To use the train metaphor, we build the rails and a top-notch track, and our users run whatever trains they want, however they want, with their own security on board (or not).
It is not the whole answer to the cybersecurity question. But it is part of it (the part too often forgotten in the debate, incidentally).
To each their own trade.
Why peer?
This news was first published on LinkedIn. To comment or share it, head to the original post. → See the post